CVE-2026-47948 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this issue by injecting malicious JavaScript into vulnerable form fields. When a victim accesses the page containing the injected script, the malicious code executes in their browser, potentially leading to information disclosure or session hijacking. The vulnerability scope is changed, indicating a broader impact than initially assessed. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of the victim's browser session when viewing affected pages. This can lead to theft of sensitive information, session tokens, or other malicious actions within the victim's browser context. The vulnerability does not impact system availability. The scope change indicates that the vulnerability may affect components beyond the initially targeted area.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable forms to trusted users only and applying input validation or sanitization controls where possible. Monitor Adobe's official security advisories for updates on patches or official mitigations.